From the standpoint of the Control Panel, this is essentially true. From a security standpoint, this is a good thing. It may seem inconvenient for your client, but often the client thinks any security is a hassle.
I have been able to use the same username and password for all 3 (client login, domain/ftp, email name), but since they are stored separately in the psa database, if you want to change the password, you have to change them from 3 different screens since they are actually used for 3 different scenarios/functions.
Note: This also means that when that username is used to login to the control panel, it will always login to the client admin screen since that is the highest function (ie. no way to login to the CP specifically to just the mail user screen or domain admin screen)
Note2: I only did this as a test, since it really is a silly thing to do from a security standpoint, even if it is a single user client/domain user/mail user. (IMO)
Note3: When I have a client who absolutely insists on having everything 'his way', I switch him to his own dedicated server (at a higher price) either unmanaged, or managed (more $$). Afterall, if they insist on having potential future problems, then they will have to pay the price. And then the only risk is to their own domain(s), not other shared domains on a shared hosting box. (again IMO)